LearnViz CompSci
Home / Learn / Security & Cryptography / Message Authentication Codes

Intermediate Topic 23 of 51 Security & Cryptography

Message Authentication Codes

Keyed tags verifying message integrity.

How it works

A message authentication code is a short tag computed from a message and a shared secret key that lets the receiver verify both integrity and authenticity. HMAC builds one from a hash function by hashing the message with the key in a nested construction; CMAC uses a block cipher; Poly1305 and GCM's GHASH are fast universal-hash-based options. Without the key, an attacker cannot forge a valid tag for a new message.

Step-by-step walkthrough

  1. Both share a secret key.
  2. The sender computes a tag with HMAC over the message.
  3. The message and tag are sent.
  4. The receiver recomputes the tag.
  5. A match proves the message is intact and from a key holder.

Where it is used

API request signing, cookies and tokens such as JWTs with HS256, TLS record protection, secure messaging and software update checks use MACs.

Common pitfall

A MAC does not give non-repudiation because both parties know the key. Comparing tags with ordinary equality can leak timing information, so use constant-time comparison. Naively concatenating key and message with a hash such as SHA-256 allows length-extension attacks. Do not reuse keys across purposes, protect against replay with nonces or timestamps and use HMAC instead of custom schemes.

Where it fits in the course

Message Authentication Codes is topic 23 of 51 in Security & Cryptography, rated Intermediate. It follows Block Cipher Modes. The next topic is SQL Injection.

Practice and explore

How to study this topic

  1. Read the explanation above and restate the definition in your own words.
  2. Open the interactive lesson and answer its mini quiz.
  3. Read the common pitfall, then write a short example that avoids it.
  4. Check your understanding in the Security & Cryptography quiz, and revisit the topic if you miss a question.

Frequently asked questions

What is Message Authentication Codes?
Keyed tags verifying message integrity. It belongs to Security & Cryptography and is an intermediate-level topic.
Where do people use Message Authentication Codes?
API request signing, cookies and tokens such as JWTs with HS256, TLS record protection, secure messaging and software update checks use MACs.
What is the most common mistake with Message Authentication Codes?
A MAC does not give non-repudiation because both parties know the key.
What should I learn before this topic?
Start with Block Cipher Modes, the topic just before it in Security & Cryptography.
How can I practice it?
Answer the mini quiz in the interactive lesson, then take the Security & Cryptography quiz.
Is Message Authentication Codes hard to learn?
It is an Intermediate topic. Be comfortable with the Beginner topics in this area first, then read the common pitfall carefully, since it is where most mistakes happen.
How long does it take to learn Message Authentication Codes?
Most learners can read the explanation and finish the interactive lesson in under an hour. Fluency comes from applying the idea, so plan a few short practice sessions with the quiz.
Which topics are related to Message Authentication Codes?
Block Cipher Modes, SQL Injection, Diffie-Hellman Key Exchange are closely connected. The full list is in the related topics section of this page.
What should I study after Message Authentication Codes?
Continue with SQL Injection, the next topic in Security & Cryptography.

Related topics